Having issues with rsyslog + SEC. The re_match's seem to be working (I
can see rsyslog launching the /usr/lcoal/sbin/sec_comware script) but the
script seems to terminate instantly without any indication of why its doing
so.
from rsyslog debug logs..
0809.267568155:7f2ed2e89700: Called action(Batch), logging to omprog
0809.267571242:7f2ed2e89700: submitBatch: enter, nElem 1
0809.267574040:7f2ed2e89700: tryDoAction 0x1d8a4a0, pnElem 1, nElem 1
0809.267577349:7f2ed2e89700: scriptExec: batch of 1 elements, active (nil),
active[0]:1
0809.267579849:7f2ed2e89700: IF
0809.267585573:7f2ed2e89700: function 're_match' (id:7, params:2)
0809.267595324:7f2ed2e89700: var '$fromhost'
0809.267604389:7f2ed2e89700: string '^(as|cs|r).*'
0809.267615970:7f2ed2e89700: eval expr 0x1d8a920, type 'F[70]'
0809.267618634:7f2ed2e89700: rainerscript: executing function id 7
0809.267621398:7f2ed2e89700: eval expr 0x1d8a410, type 'V[86]'
0809.267624950:7f2ed2e89700: rainerscript: var '$fromhost': '
r0507.mydomain.com'
0809.267628549:7f2ed2e89700: batch: item 0: expr eval: 1
0809.267631336:7f2ed2e89700: scriptExec: batch of 1 elements, active
0x7f2ec40008e0, active[0]:1
0809.267633685:7f2ed2e89700: ACTION 0x1d8b970 [:omprog:]
0809.267639989:7f2ed2e89700: RRRR: execAct [omprog]: batch of 1 elements,
active 0x7f2ec40008e0
0809.267642986:7f2ed2e89700: Called action(NotAllMark), processing batch[0]
via 'omprog'
0809.267645525:7f2ed2e89700: Called action(Batch), logging to omprog
0809.267649554:7f2ed2e89700: submitBatch: enter, nElem 1
0809.267652361:7f2ed2e89700: tryDoAction 0x1d8b970, pnElem 1, nElem 1
0809.267655016:7f2ed2e89700: Action 0x1d8b970 transitioned to state: itx
0809.267657566:7f2ed2e89700: entering actionCalldoAction(), state: itx
0809.267662537:7f2ed2e89700: Program ''/usr/local/sbin/sec_comware''
terminated, trying to restart
0809.267669158:7f2ed2e89700: waitpid() returned state -1[No child
processes], future malfunction may happen
0809.267675069:7f2ed2e89700: executing program
''/usr/local/sbin/sec_comware''
#rsyslog config
$ModLoad imudp
$UDPServerRun 514
$ModLoad omprog
$template REMOTE,"/opt/log/remote/%fromhost%/%$YEAR%-%$MONTH%-%$DAY%.log"
if re_match($fromhost,'^lb.*') then {
$actionomprogbinary '/usr/local/sbin/sec_netscaler'
*.* :omprog:
}
if re_match($fromhost,'^(as|cs|r).*') then {
$actionomprogbinary '/usr/local/sbin/sec_comware'
*.* :omprog:
}
#stop so we don't process remote logs in the 50-default
if $fromhost-ip !='127.0.0.1' then {
?REMOTE
stop
}
#sec-comware
#!/bin/bash
CONF=comware
/usr/local/sbin/sec -conf=/usr/local/etc/sec/$CONF -pid=/tmp/sec-$CONF.pid
-dump=/tmp/sec-$CONF.dump -debug=5 -syslog=local1 -intevents -input=-
------------------------------------------------------------------------------
This SF.net email is sponsored by Windows:
Build for Windows Store.
http://p.sf.net/sfu/windows-dev2dev
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
